> ## Documentation Index > Fetch the complete documentation index at: https://docs.usenexio.com/llms.txt > Use this file to discover all available pages before exploring further. # Connector types > Know exactly what to hand Nexio for each supported connection type, which permissions the account needs, and what a successful validation proves. Each connector type needs a specific set of credentials and scope. The types are a fixed set in code; this page covers the five that can be created for your organization. You provide them to Nexio; Nexio enters them and validates them against your system, and a passing validation activates the connection. This page lists every field, the permission the account needs, and what the validation probe checks. For what a connection is and who operates it, see [Connections and data](/connections/overview). ## How secrets are handled * Secret fields (client secrets, passwords, private keys, tokens, header values) are encrypted per field with AES-256-GCM before they are stored. A PostgreSQL connection URL is encrypted whole. * For Snowflake, HTTP API and MCP connections, a passing validation stores a short, non-secret summary of what the probe found. For SharePoint it stores the resolved library (drive) ID. * Every PostgreSQL, Snowflake, HTTP API and MCP address you supply passes a network guard before Nexio connects to it. The guard resolves the host and refuses loopback, private, link-local, multicast and cloud metadata addresses. For HTTP API, MCP and Snowflake connections it also checks the exact address each connection dials, so a DNS change cannot reach an internal address. HTTP API and MCP connections follow no redirects. A SharePoint connection reaches only Microsoft's own endpoints; its site URL is sent to Microsoft Graph, not dialed. * An HTTP API or MCP connection that sends a credential must use `https`. ## SharePoint document library Connection type `materialize`. Nexio replicates the files under the folders you name, then indexes and extracts them. See [Indexing and extraction](/connections/indexing-and-extraction). | Field | Required | Notes | | ------------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Directory (tenant) ID | Yes | Your Microsoft Entra tenant. | | Application (client) ID | Yes | The Entra app registration Nexio authenticates as. | | Client secret | Yes | Secret. Encrypted at rest. | | Site URL | Yes | For example `https://contoso.sharepoint.com/sites/contracts`. | | Library | No | The document library name. When omitted, the site's default document library is used. | | Crawl roots | No | One or more folders to read. Leading and trailing slashes are trimmed, duplicates are removed (ignoring case), and a root nested inside another root is refused (it would read the same files twice). Empty means the library root. | | Counterparty folder level | No | Which folder level under a root names the counterparty a document belongs to, or that each root is itself one counterparty's folder. Documents are attributed to that counterparty. | | Excluded paths | No | Folders to skip. Literal path segments, with an optional trailing `*` wildcard. | **Permissions.** Grant the Entra app application permissions `Sites.Read.All`, `Files.Read.All`, or both. Grant nothing else. **Read-only, enforced.** The platform sends only GET requests to Microsoft Graph. The only POST is the OAuth token exchange with the Microsoft identity endpoint. A CI gate fails any code change that sends a non-GET request to Microsoft Graph. The access token is cached and refreshed 60 seconds before expiry; on a `401` the platform re-authenticates once. **Validation.** Nexio signs in as the app, resolves the site URL and library to a Microsoft Graph drive, and checks that each crawl root exists and is a folder that is not empty. The whole check runs within 20 seconds. A pass proves the app can authenticate and see that library and those folders. ## PostgreSQL Connection type `postgres`. Queried in place. | Field | Required | Notes | | -------------- | -------- | --------------------------------------------------------------------------------------------------------------------- | | Connection URL | Yes | Encrypted whole. Must set `sslmode=require`, `verify-ca` or `verify-full`. The host must resolve to a public address. | **Permissions.** A database user with read access to the tables in scope. **Validation.** Nexio checks the URL against the SSL and host rules, then connects and runs `SELECT 1`, within 5 seconds. A pass proves the host is reachable over TLS and the credentials open a session. ## Snowflake Connection type `snowflake`. Queried in place by [Records](/data-services/overview). | Field | Required | Notes | | --------------------- | --------------- | --------------------------------------------------------------------------- | | Account | Yes | Your account identifier. The account host must resolve to a public address. | | Warehouse | Yes | | | Database | Yes | | | Schema | Yes | | | Role | Yes | The role Nexio's sessions use. | | Username | Yes | | | Authentication method | Yes | `password` or `keypair`. | | Password | With `password` | Secret. | | Private key | With `keypair` | An RSA key in PKCS #8 PEM. Secret. | **Permissions.** A role with read access to the schemas in scope. Nexio's warehouse reads pass a statement guard that admits read statements only. **Network.** An account reachable only through PrivateLink resolves to a private address from Nexio's network and is refused. **Validation.** Nexio opens a session, runs `SELECT 1`, then switches to the role, warehouse, database and schema. All of this runs within 10 seconds. A pass proves the credentials open a session and the role can use that warehouse, database and schema. ### What Records needs Records reads a system of record that you replicate into Snowflake. Nexio does not copy the rows to serve these reads: each read queries your warehouse when it is asked. The connection reads two areas of your warehouse. Its user needs read access to each area through the role the connection sets for that area (one role can serve both): 1. **A curated dimensional model** built from the source system. 2. **The current replicated source tables** of the source system, grouped by area. A Snowflake connection serves Records reads only when it is `ACTIVE` and Nexio has bound the datasets that its system-of-record type requires. Without them, the connection serves no Records reads; see [Completeness and errors](/data-services/completeness) for the refusal you receive. Nexio sets up the bindings with you during onboarding. You do not configure them. A source area that is missing or unreadable does not fail every read. A read that needs it reports that family as unavailable, as described in [Completeness and errors](/data-services/completeness). The [data graph](/data-services/graph) lists your connections and the derivations scheduled on them. ## Generic API Connection type `api`. Built, not yet enabled: the connection can be created and validated; no engine reads it at run time yet. | Field | Required | Notes | | ----------------------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Base URL | Yes | Must use `https` when authentication or default headers are set. | | Authentication type | Yes | `none`, `api_key`, `bearer`, or `oauth2_client_credentials`. | | API key header and API key | With `api_key` | The key is secret. | | Bearer token | With `bearer` | Secret. | | Token URL, client ID, client secret | With `oauth2_client_credentials` | The token URL must use `https`. The client secret is secret. | | Scope | No | Sent with the token request when set. | | Default headers | No | Header values are secret. | | Test request | Yes | Method (`GET`, `HEAD`, `POST`, `PUT`, `PATCH` or `DELETE`), path, and optionally the expected status code. The probe sends it as configured, so choose a request that changes nothing, such as a `GET` on a health or list endpoint. | **Validation.** Nexio obtains credentials as configured and sends the test request through the guarded client. Each HTTP call is capped at 10 seconds and the whole probe at 15 seconds. The probe passes when the response status equals the expected status, or is any 2xx when none is set. The stored summary is the status, method and path, for example `HTTP 200 from GET /v1/health`. ## MCP server Connection type `mcp_server`. Built, not yet enabled: the connection can be created and validated; no engine reads it at run time yet. | Field | Required | Notes | | --------------------- | ------------- | -------------------------------------------------------------------- | | Server URL | Yes | Must use `https` when authentication is set. | | Transport | Yes | `streamable_http` or `sse`. Local `stdio` servers are not supported. | | Authentication type | Yes | `none`, `bearer`, or `header`. | | Bearer token | With `bearer` | Secret. | | Header name and value | With `header` | The value is secret. | **Validation.** Nexio performs the MCP `initialize` handshake, lists the server's tools, and lists its resources when the server declares them. Each HTTP call is capped at 10 seconds and the whole probe at 15 seconds. The stored summary is the server name, its version, and the tool and resource counts. ## Types you do not create `blob_corpus` is a retired alias of the SharePoint type. `http_enrichment` names the enrichment providers Nexio calls during a run, with credentials Nexio holds. Neither is created for a customer, and neither needs anything from you. ## Validation result Every probe reports whether it passed and, when it failed, a plain message saying what failed. A pass activates the connection. Snowflake, HTTP API and MCP probes also return a short, non-secret summary on a pass, which Nexio stores on the connection. PostgreSQL and SharePoint probes return no summary. A failed validation sets the connection to `PENDING` with that message. Nexio corrects the credentials or scope with you and validates again.